THORChain Upgrade Targets Rujira Trading Restart After FIN Exploit

THORChain plans to patch a Rujira smart contract flaw in its v3.21 upgrade, setting up a request to reopen trading, lending and borrowing after an exploit halted Rujira’s app layer.

The upgrade targets block 28,366,100, projected for Friday, Oct. 23. The block height controls activation, so the date is an estimate. If the upgrade succeeds, Rujira plans to ask THORChain node operators to lift the pause on its services.

Rujira’s products run as smart contracts on THORChain. Pausing Rujira’s app layer stopped those contracts without stopping THORChain’s base layer. Trading, lending and borrowing through Rujira depend on the app-layer pause being removed.

The exploit reported Sept. 26 involved FIN’s position-transfer function. The flaw allowed an attacker to move a custom concentrated liquidity position they did not own. Such a position supplies liquidity within a price range chosen by its owner. The incident affected one position held by Rujira’s team, and no user funds were lost.

Rujira’s restart plan includes a conditional safeguard for borrowers. If any Credit Account position has a loan-to-value ratio above 100% and qualifies for liquidation when the app layer is ready to resume, Rujira plans to ask node operators to keep the Credit Account contract paused for another 24 hours. Loan-to-value compares the size of a loan with the collateral backing it.

The proposed extension would give borrowers time to add collateral through Rujira Borrow or by sending assets directly to their Credit Account address. A liquidator can trigger liquidation for positions that remain eligible after the grace period. The additional pause depends on the stated condition and a request to node operators; it is not an automatic part of the upgrade.

The release also includes fixes for SwapKit affiliate fee payments and limit swaps. The next step for Rujira is to seek removal of the app-layer pause after the v3.21 upgrade succeeds.